How can I prevent N+1 query issues in GraphQL while preserving field-level authorization?

I am building a GraphQL API where organizations contain many users, and users have nested relationships such as roles, permissions, phone numbers, and email addresses.

A common issue I am encountering is the N+1 query problem. For example, fetching 100 users may result in 100 additional database queries for related data. I understand that DataLoader can batch requests, but I also need field-level authorization checks because different users may have different permissions to access specific fields.

What is the recommended architecture for handling:

1. Efficient batching of nested GraphQL resolvers.

2. Field-level authorization.

3. Avoiding duplicate database queries.

4. Maintaining clean resolver code.

Are there established patterns or best practices used in production GraphQL systems for this problem?